Directory & File Exposure

What this check looks for

StackShield requests directory paths that have no index file and checks whether the server responds with an auto-generated listing of their contents. It is reading whether your web server has directory indexing enabled, which turns any folder without an index.html into a browsable file explorer.

Why it matters

Directory listing hands an attacker a map. Instead of guessing which files exist, they see them: backups, uploads, logs, exports, old versions. A listing on an uploads directory reveals every file other users have uploaded. A listing on a storage or export path reveals data that was never meant to be enumerable.

The information is valuable even when no single file is itself a secret, because reconnaissance is most of an attack. Knowing exactly what is there removes the guesswork and often surfaces a file the owner forgot was reachable.

What a failed check means

A failed check means the server returned a browsable index for a directory rather than a 403 or a real page. On its own it is an information-disclosure finding; combined with a sensitive file in that directory, it is the thing that led an attacker to it.

The fix is disabling auto-indexing at the web-server level, so a directory without an index file returns 403 rather than its contents.

See the step-by-step remediation: how to fix this.